在linux内核上寻找系统调用实现

Question

I'm looking for the implementations of open() , close() , write() and unlink() , but I can't find them anywhere! Every function I find is like sys_open , do_open , etc_open ... but nothing with the interface we use. Can you help me?

I need to discover what kind of security checks they make

Answer 1

If you mean the library calls such as those found in fcntl.h , they're not part of the kernel, they're part of glibc .

If you are referring to the actual kernel calls, the system call xyzzy is usually handled by the function sys_xyzzy .

The entry.S file, at least in 2.4 (I haven't looked at later kernels), held a table mapping system call numbers to functions:

.data
  ENTRY(sys_call_table)
      .long SYMBOL_NAME(sys_ni_syscall)       /* 0  -  old "setup()" system call*/
      .long SYMBOL_NAME(sys_exit)
      .long SYMBOL_NAME(sys_fork)
      .long SYMBOL_NAME(sys_read)
      .long SYMBOL_NAME(sys_write)
      .long SYMBOL_NAME(sys_open)             /* 5 */
      .long SYMBOL_NAME(sys_close)
      .long SYMBOL_NAME(sys_waitpid)
      .long SYMBOL_NAME(sys_creat)
      .long SYMBOL_NAME(sys_link)
      .long SYMBOL_NAME(sys_unlink)           /* 10 */
      .long SYMBOL_NAME(sys_execve)
      .long SYMBOL_NAME(sys_chdir)
      .long SYMBOL_NAME(sys_time)
      .long SYMBOL_NAME(sys_mknod)
      .long SYMBOL_NAME(sys_chmod)            /* 15 */
        :
      .long SYMBOL_NAME(sys_ni_syscall)       /* sys_remap_file_pages */
      .long SYMBOL_NAME(sys_ni_syscall)       /* sys_set_tid_address */

KernelGrok seems to have a useful page showing the system calls, their names, parameters, and where to find the source. For example (slightly reformatted):

  0   sys_restart_syscall
      eax = 0x00
      kernel/signal.c:2058
  1   sys_exit
      eax = 0x01
      ebx = int error_code
      kernel/exit.c:1046
  2   sys_fork
      eax = 0x02
      ebx = struct pt_regs *
      arch/alpha/kernel/entry.S:716
  3   sys_read
      eax = 0x03
      ebx = unsigned int fd
      ecx = char __user *buf
      edx = size_t count
      fs/read_write.c:391
  4   sys_write
      eax = 0x04
      ebx = unsigned int fd
      ecx = const char __user *buf
      edx = size_t count
      fs/read_write.c:408
  :

and so on. But, being old school, I prefer to keep kernel sources local and just use grep :-)

Answer 2

You need to look for SYSCALL_DEFINE macro in kernel sources. For example, grepping for unlink at /fs gives the following:

$ grep -r -n SYSCALL_DEFINE *.c | grep unlink

namei.c:2811:SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
namei.c:2822:SYSCALL_DEFINE1(unlink, const char __user *, pathname)

Note that the number after SYSCALL_DEFINE is the syscall argument count.